Vulnerabilities · 104 days ago
Rockwell’s latest patch set matters, but the operational problem is the older, already-exploited trust path that is still sitting in deployed OT gear. The company confirmed in-the-wild abuse of CVE-2021-22681, even as its new advisories for Logix, CompactLogix, ControlLogix, Flex I/O, RSLinx, and FactoryTalk have not yet been seen targeted.
The new fixes cover DoS bugs in controllers, authentication-bypass and password-change issues in FactoryTalk Historian Site Edition and Flex I/O dual-port Ethernet/IP adapters, and an improper API authorization flaw in FactoryTalk Analytics PavilionX. For plant and critical-infrastructure teams, the sharper risk is still legacy engineering and controller assets that trust device identity or session state and may be exposed through a path attackers already know works.
Known exploited · CISA KEV
CVSS 9.8 CRITICAL: rockwell Automation Studio 5000 Logix Designer Versions 21 and later, and RSLogix 5000 Versions 16 through 20 use a… EPSS 64% (99th percentile).
CISA federal remediation date Mar 26 · date passed
2 sources covering this story
Rockwell Automation Patches Vulnerabilities in ICS Controllers and Software
The industrial automation giant has fixed security holes in Logix, CompactLogix, Flex, RSLinx, and FactoryTalk products.
Rockwell Automation Logix 5370 & 5570 Controllers Vulnerable To Denial of Service Via CIP | CISA
Rockwell Automation Logix 5370 & 5570 Controllers Vulnerable To Denial of Service Via CIP Summary Successful exploitation of this vulnerability could cause a denial-of-service condition that may result in a major nonrecoverable fault (MNRF).
Rockwell Automation RSLinx | CISA
Rockwell Automation RSLinx Summary Successful exploitation of this vulnerability can lead to a denial of service, where the application will become unresponsive and will not recover on its own.
Rockwell Automation CompactLogix | CISA
Rockwell Automation CompactLogix Summary Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition.
Part of the PlainSec briefing for 2026-06-18